Paper/Archive/CVE-2023-43696

CVE-2023-43696

SICK AG APU0200 — Improper Access Control in SICK APU allows an unprivileged remote attacker to download as well as upload arbitrary files via anonymous ac…

EPSS 0.9%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 59.2.592 × 2011.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Improper Access Control in SICK APU allows an unprivileged remote attacker to download as well as upload arbitrary files via anonymous access to the FTP server.

Affected

ProductAffectedFixed inSource

APU0200all versions–CNA

apu0200_firmware< 4.0.0.64.0.0.6CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SICK AG (CNA)8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refsick.com/psirt advisorysick.com/.well-known/csaf/white/2023/sca-2023-0010.pdf refsick.com/.well-known/csaf/white/2023/sca-2023-0010.json